ASPIRE: Agentic Safety & Prompt Injection Red-teaming Engine

What it is

ASPIRE is a red-teaming framework from Google Cloud AI Research / Google / Michigan State University (He, Mitra, Sharma, Tang, Rao, Pfister, Le) for discovering indirect prompt-injection vulnerabilities in LLM agents. Its core departure from prior tools (AgentVigil, AgentXploit, VeriGrey, AutoInject, PISmith) is separating vulnerability-hypothesis search from payload optimization: it searches over consequence/method/environment combinations before ever writing an attack string.

How it works

Each hypothesis is a "test skeleton" z=(C,M,E) — a target consequence, injection method, and injection environment — kept distinct from the instantiated test x=(C,M,E,T,P), where T is a benign user query and P is the injected payload. A separate "realizer" module turns skeletons into concrete tests only after the hypothesis is chosen.

flowchart LR
    E[Injection Environment] --> T[Access Tool]
    T --> O[Observation]
    O --> R[Planner/Reasoning]
    R --> A[Action Tool]
    A --> S[Persistent State]
    R -.blocked.-> G[Confirmation Guard]

The Agent Security Behavior Graph tracks edges like this as untested, supported, blocked, conditional, or saturated based on execution evidence. Two experts drive the loop each round: Explore targets unconfirmed consequences and under-tested paths; Exploit verifies and generalizes already-promising ones (reproducing confirmed vulnerabilities, testing transfer across environments/methods). Each executed test is scored with rule-based checks (was the tool actually called with grounded arguments, did the side effect occur) plus an LLM evaluator that decomposes the trajectory into retrieval/planning/invocation/effect-realization stages to localize where an attempt stalled. Evidence updates the graph; a cross-run "strategy memory" distills transferable search heuristics (not specific attack strings) for future runs.

What it do

Outputs are two artifacts rather than just attack strings: a vulnerability report per confirmed case (full evidence chain from environment to consequence, plus a behavioral root cause like "source-instruction confusion" or "unsafe sensitive-argument construction"), and a vulnerability map showing confirmed/partial/failed/untested combinations across the explored surface — explicitly treating failed attempts as informative stall points, not proof of safety.

Preconditions / Affected

Applies to tool-using LLM agents that ingest untrusted content (email, calendar, web) as part of normal workflows — the same class covered by AgentDojo, InjecAgent, WASP-style benchmarks.

Caveats

The paper states results as ~50% attack success rate with 98.4% tool coverage and 100% environment coverage at ≤$2.00 per discovered vulnerability on its benchmarks — but gives no benchmark names, model list, or cost breakdown in the excerpted text, and the cross-run strategy memory section is cut off before explaining its mechanism.